Input validation

Missing authentication and improper input validation in KERUI Wifi Endoscope Camera YPC99 allow an attacker to execute arbitrary commands with a length limit of 19 characters via the "ssid" value, as demonstrated by ssid:;ping 192.168.1.2 in the body of a SETSSID command...

CVE-2018-13114

Missing authentication and improper input validation in KERUI Wifi Endoscope Camera YPC99 allow an attacker to execute arbitrary commands with a length limit of 19 characters via the "ssid" value, as demonstrated by ssid:;ping 192.168.1.2 in the body of a SETSSID command...

CVE-2018-13115

Lack of an authentication mechanism in KERUI Wifi Endoscope Camera YPC99 allows an attacker to watch or block the camera stream. The RTSP server on port 7070 accepts the command STOP to stop streaming, and the command SETSSID to disconnect a user...